Skip to content
OpenAdvisories
Medium ALAS2-2019-1246 9 CVEs

Moderate: java-11-amazon-corretto security update (Amazon Linux 2)

Published Jul 18, 2019 · Updated Jul 22, 2019

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-7317: png_image_free in png.c in libpng 1.6.36 has a use-after-free because png_image_free_function is called under png_safe_execute. 1672409: CVE-2019-7317 libpng: use-after-free in png_image_free in png.c CVE-2019-2821: 1730251: CVE-2019-2821 OpenJDK: Incorrect handling of certificate status messages during TLS handshake (JSSE, 8222678) CVE-2019-2818: 1730078: CVE-2019-2818 OpenJDK: Non-constant time comparison in ChaCha20Cipher (Security, 8221344) CVE-2019-2816: 1730099: CVE-2019-2816 OpenJDK: Missing URL format validation (Networking, 8221518) CVE-2019-2786: 1730255: CVE-2019-2786 OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381) CVE-2019-2769: 1730056: CVE-2019-2769 OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432) CVE-2019-2766: 1730459: CVE-2019-2766 OpenJDK: Insufficient permission checks for file:// URLs on Windows (Networking, 8213431) CVE-2019-2762: 1730415: CVE-2019-2762 OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328) CVE-2019-2745: 1730411: CVE-2019-2745 OpenJDK: Side-channel attack risks in Elliptic Curve (EC) cryptography (Security, 8208698)

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2 java-11-amazon-corretto 1:11.0.4+11-1.amzn2
Amazon Linux · 2 java-11-amazon-corretto-headless 1:11.0.4+11-1.amzn2
Amazon Linux · 2 java-11-amazon-corretto-javadoc 1:11.0.4+11-1.amzn2

Vulnerabilities 9

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-2745.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-2762.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-2766.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-2769.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-2786.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-2816.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-2818.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-2821.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-7317.html